# Logstash - complex filtering
**URL:** https://discuss.elastic.co/t/logstash-complex-filtering/85433
**Category:** Logstash
**Created:** [May 11, 2017, 3:19pm UTC](https://discuss.elastic.co/t/logstash-complex-filtering/85433 "2017-05-11T15:19:08Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Vedran\_Maricevic](https://discuss.elastic.co/u/Vedran_Maricevic)
#### Post date: [May 11, 2017, 3:19pm UTC](https://discuss.elastic.co/t/logstash-complex-filtering/85433/1 "2017-05-11T15:19:09Z")
I have ELK setup. I am parsing several completely different log formats. They were all one liners. Now I need to add a different one which is a multi line.
Example of two log entries:
> error: callback invoked exception. sent payload: [{"key": "values"}]
> custom status response: [{"key": "values"}]
> callback headers: [{"key": "values"}]
> error stack: [ something really bad happened
> at here loremisptul (/xx/xx/x)
> at here loremisptul (/xx/xx/x)
> at here loremisptul (/xx/xx/x)
> at here loremisptul (/xx/xx/x)
> at here loremisptul (/xx/xx/x)]
> error: callback invoked exception. sent payload: [{"key": "values"}]
> custom status response: [{"key": "values"}]
> callback headers: [{"key": "values"}]
> error stack: [ something really bad happened
> at here loremisptul (/xx/xx/x)
> at here loremisptul (/xx/xx/x)
> at here loremisptul (/xx/xx/x)
> at here loremisptul (/xx/xx/x)
> at here loremisptul (/xx/xx/x)]
This is my logstash configuration file:
input {
beats {
port =\> "5043"
codec =\> json
}
}
filter {
if [@metadata][type] == "qa-error"
{
grok {
match =\> { "message" =\> "{GREEDYDATA:stackone}" }
}
}
}
output
{
...write it to ES
}
With this setup, every line is written as a separate document in ES. I made a bit research, and it seems I might have to end up using multiline codec inside my filebeat.
But if I place that codes, then all of the other filters are not working properly any more.
How can I approach this ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 11, 2017, 5:54pm UTC](https://discuss.elastic.co/t/logstash-complex-filtering/85433/2 "2017-05-11T17:54:59Z")
> But if I place that codes, then all of the other filters are not working properly any more.
That's impossible to answer without more information.
---
### Author:  [@Vedran\_Maricevic](https://discuss.elastic.co/u/Vedran_Maricevic)
#### Post date: [May 12, 2017, 7:32am UTC](https://discuss.elastic.co/t/logstash-complex-filtering/85433/3 "2017-05-12T07:32:32Z")
Thank you for reply. I have found at the documentation that multiline codec in Logstash should be [avoided](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#multiline).
therefore I have move to multiline in filebeat., in this [thread](https://discuss.elastic.co/t/multiline-configuration-several-prospectors/85511).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 9, 2017, 7:35am UTC](https://discuss.elastic.co/t/logstash-complex-filtering/85433/4 "2017-06-09T07:35:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.